Departments

As Chief Privacy Officer at Facebook, Richter has Friends (and Critics) in High PlacesBy Van Jensen

Facebook's more than 500 million users share about 1 billion posts, links and photos every day.

The torrent of information on the site — where users live, what they like, how old they are, who their
friends are — gives Facebook one of the deepest wells of personal data on the Internet and is a large part
of why the company is so admired by Wall Street. In January, Facebook received a $1 billion investment
arranged by Goldman Sachs and was valued, some say conservatively, at $50 billion.

But that trove of information is a double-edged sword. It also makes Facebook a target for those who sell
or otherwise exploit personal data. For instance, an October 2010 Wall Street Journal investigation revealed
that third-party applications on Facebook had been accessing users' information and transmitting it to Internet
tracking companies.

Facebook is confronted with a paradox: Users flock to the site because it allows them to share information and photos with
others, but at the same time they expect Facebook to safeguard their information.

The challenge of balancing those seemingly incongruous desires falls in large part on the shoulders of Facebook's chief
privacy counsel, Michael Richter L'93. Richter faces the heady tasks of keeping the company in compliance with privacy laws
around the world and helping craft policies to satisfy users and regulators.

Richter, who calls himself Facebook's privacy ombudsman, works with product managers, engineers and the management
team on the development of new products. He also meets with regulators and privacy groups in advance of product launches.

"Privacy comes up in every product that we build," said
Richter, who joined the company in 2007 with limited privacy
law experience. "I had to learn everything there is to know
about privacy and give the company good legal advice, balancing
what's best for the company with the legal risks."

Richter always has pursued assignments that he finds interesting
and challenging rather than ones that offer the most
impressive title. He joined Facebook after serving as head of
both worldwide litigation and intellectual property at eBay.

His career also has had detours into screenwriting, theater and
independent film.

Challenges Aplenty at Facebook

Challenges at Facebook came in short order for Richter when
the Canadian privacy commissioner declared that the company
did not meet Canada's privacy laws. Richter worked closely with
regulators to resolve the issue. The agreement is confidential, but
Richter said the key was in educating the privacy commissioner
on how Facebook operates.

"At the highest level, Facebook and regulators have the same
goal," he said. "We are both trying to give users control over
their information. When we don't agree, it's usually because the
regulator is trying to protect user privacy in a context where
users want to share their information."

Another challenge Facebook faced early in Richter's time
at the company was with its Beacon advertising program.

Launched in 2007, the service automatically posted notices on
users' profiles when they interacted with third-party companies
such as Blockbuster and Overstock.com. Critics argued that the
system operated without explicit permission from users, and in
2008 some users filed a class action lawsuit. Facebook shuttered
Beacon in 2009 and settled the lawsuit.

Richter called the program misunderstood. Users thought of
it as a purely commercial product and not as a system to share
outside information within Facebook, he said. Now, he pointed
out, users share outside links and other information constantly.

Much of the criticism of Facebook has implied that the company
seeks to exploit user information toward monetary gain.

A legal scholar from the University of Pennsylvania Wharton
School described Facebook's tactics as "act now, apologize later."

Richter disagreed with that assessment. Facebook explicitly
prohibits app creators from sharing user information, he said. The
company makes money through its targeted advertising program
and credits purchased to use within applications. Neither of those
activities provides outsiders with access to users' personal data.

Facebook always has made privacy a top priority, Richter
said. But since he started, the company has expanded the number
of employees who focus specifically on that area.

"I think it gets better headlines when people criticize our
approaches to privacy," Richter said. "But the fact of the matter
is that we have better privacy controls than almost any
other site. … I think we do a much better job than people give
us credit for."

Much of Richter's effort in recent years has gone into updating
and revising Facebook's privacy policy and statement
of rights and responsibilities. Those came under scrutiny by
the Electronic Privacy Information Center and others in 2009,
which led to the revision.

made two posts about the changes on the Facebook
blog, each of which drew hundreds of comments. The second
entry, in March 2010, revealed that all proposed changes to the
policies would be posted publicly, and users could offer feedback.

"Ultimately it was a great experience, because we're doing
something really unique," he said. "We give users an opportunity
to vote on [changes], which I don't think any company has
ever done."

Simple Privacy Controls Not So Simple to Achieve

Richter's job also entails dealing with frequent public criticism,
such as in May 2010 over what a writer on techcrunch.

com called the company's "mind bogglingly complex" privacy
controls. After listening to feedback from users, Facebook
introduced a new simplified privacy control that has been
well received.

"It's a balancing act between simplicity and granularity of
controls," Richter said. "Some users want to be able to tweak
every setting for every piece of content. But to a lot of people
that's very confusing."

One lesser-known privacy control that Facebook introduced
is within the publisher - the field that allows users to
share a status update, link, photo or video. Next to the Share
button is the icon of a lock. By clicking on it, users can decide
who among their friends or non-friends will be able to see
what is posted.

Richter keeps part of his profile open to anybody, and one
can learn that he was born in Miami and is a fan of both the Miami
Heat and Los Angeles Clippers. Among his favorite bands
are Wilco and Arcade Fire. But to understand how Richter came
to Facebook, you have to dig a little deeper.

Richter came to Penn Law through New York City, where
his parents sent him for boarding school. At the time, he'd never
been to New York and didn't know a soul there.

Though he'd planned to attend law school from an early age,
he took a year after receiving his bachelor's degree at Yeshiva
University to explore his interest in theater and film. He acted
in a play and wrote screenplays, selling one script to a producer
who was also a lawyer.

"He convinced me the best way to get involved in the entertainment
business was as a lawyer," Richter said. "It's really
hard to get people to take a look at your [screenplay]. Law was
the easiest way for someone like me without a lot of connections
to work my way into the industry."

Richter enrolled at Penn Law, and he quickly felt at home.

"[Penn] tries to foster community," Richter said. "And the
type of students they select, everyone is obviously very intelligent,
but they're well rounded and diverse."

At Penn, Richter kept up his artistic interests. He directed
Chicago for the Law School Light Opera Company and wrote
and acted for the law revue. He recalled acting in one skit
that drew laughter and applause. Afterward a deputy dean
asked Richter, "What the hell are you doing in law school?"
Richter channeled his passions into working in entertainment
law in New York, and eventually he became interested in Internet
law. The dot-com boom had started, and Silicon Valley firms
were desperate for lawyers. He and his wife, Sara, moved to
California in 1999.

"This was the place to be," Richter said. "This was where all of the cutting edge legal issues were happening."

After working at a firm and at eBay, Richter found his way
back into the arts. While at eBay, he penned a screenplay called
Two Mothers. It follows two women who meet after both of
their sons die in a bus bombing. Fellow alumnus Marc Posner
C'85, L'92, helped him on the script.

Richter partnered with a production company he had volunteered
with previously. The movie was filmed in northern California.

After the festival circuit, the producers plan to release the
movie in a few cities and, if it's successful, have a wider release.

Richter is glad to have taken the risk of making the film.

"It was a fantastic experience," he said. "I liked being involved
in the process. The story I wanted to tell was pretty much what
ended up on the screen."

Nevertheless, Richter was quick to say he doesn't see film as a
career. Facebook continues to offer a variety of challenges. Every
day those 500 million users are posting a billion updates, and it's
up to the privacy ombudsman to look out for them. PLJ

Van Jensen is assistant editor of the Georgia Tech
Alumni Magazine and a freelance writer whose work has
appeared in publications such as Atlanta, Sojourners and
Publi shers Weekly. He is the author of the graphic novel
trilogy Pinocchio, Vamp ire Slayer and the upcoming comic
book series Snow White: Through a Glass , Darkly.